Automakers now have a shared way to itemise the software inside a vehicle. The Linux Foundation published the OpenChain Automotive Software Bill of Materials Framework 1.0, a common method for compiling and exchanging inventories of vehicle code.
Announced at Open Source Summit Europe in Prague on 7 October, the framework sets out how automotive SBOM data should be structured and which fields it must carry. It adds completeness and quality criteria, plus scenarios for passing data between suppliers and manufacturers.
It builds on SPDX (ISO/IEC 5962), the existing bill-of-materials standard, and shows how to apply it consistently across the car industry. The work began in talks between Keisuke Takase of Toyota, Ayumi Watanabe of Hitachi Solutions and Masato Endo, who chairs the OpenChain Automotive Working Group.
Automaker backing gives it early weight. Nissan and Volvo Cars have endorsed the framework, and Volvo already runs a continuous SBOM program in vehicle development. Tooling firm FossID plans to help teams generate and validate files to the standard.
The pressure is regulatory. Cybersecurity rules such as UNECE R155 push manufacturers to account for every component and dependency in a vehicle’s software, and a shared format makes gaps easier to spot and harder for suppliers to leave undisclosed.
“As software-defined vehicles grow in complexity, improving transparency and traceability across software components is becoming essential,” said Mary Meixia Wang, general manager of the OpenChain Project.
Rival carmakers backing one framework suggests SBOM practice is becoming table stakes rather than a competitive edge.
